Actively exploited · CISA KEV · NVD published 2026-07-22
Actively exploitedCVE-2026-16232
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
- KEV
- same day →First PoC
- 35 days →Metasploit
Signals
- Exploited in the wild
- Yesadded 2026-07-22 · due 2026-07-25. An observation, not a forecast.
- EPSS · 30-day forecast
- 78%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD · CRITICAL
- 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
5 known · links onlyGitHub PoCs · by trust, then stars3
- sfewer-r7/CVE-2026-16232 ↗Trust ok 100
A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token.
★ 11 · created 2026-07-28
- HackSpeak/CVE-2026-16232 ↗Trust ok 100
CVE-2026-16232 (Check Point SmartConsole authentication bypass) PoC - unauth to admin; for authorized security testing
★ 3 · created 2026-08-03
Local web app for conducting a Check Point Trusted Access Review. This scanner is built specifically to look for configuration issues around CVE-2026-16232, CVE-2026-62144 , and CVE-2026-62145. This tool is not created or supported by Check Point and should be used at your own risk.
★ 0 · created 2026-07-22
Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.
Metasploit1
This module exploits CVE-2026-16232, an authentication bypass in the Check Point SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server. A vulnerable management server accepts a client-supplied SIC distinguished name during an application certificate bind instead of binding the application identity to the authenticated peer certificate. The module uses the unauthenticated FWM/CPMI se
ruby · seen 2026-10-18
Nuclei1
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this
yaml · seen 2026-10-18
On the wire
1 dispatchWatch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.